Set FEATURE_SECURE_PROCESSING for DocumentBuilderFactory

veraPDF · Dec 1, 2024 · a036e64 · a036e64
1 parent 225c64c
commit a036e64
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/gui/src/main/java/org/verapdf/apps/utils/ApplicationUtils.java b/gui/src/main/java/org/verapdf/apps/utils/ApplicationUtils.java
@@ -19,6 +19,7 @@
 import org.w3c.dom.Document;
 import org.xml.sax.SAXException;
 
+import javax.xml.XMLConstants;
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
@@ -150,6 +151,11 @@ public static boolean isLegalExtension(final List<File> toCheck, final String[]
 
 	public static FeatureExtractorConfig mergeEnabledFeaturesFromPolicy(FeatureExtractorConfig currentConfig, InputStream policy) throws ParserConfigurationException, IOException, SAXException, XPathExpressionException {
 		DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+		try {
+			dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+		} catch (Exception e) {
+			LOGGER.log(Level.WARNING, "Unable to secure policy processing");
+		}
 		dbf.setNamespaceAware(true);
 		DocumentBuilder db = dbf.newDocumentBuilder();
 		Document document = db.parse(policy);